This Privacy Policy (hereinafter referred to as this “Policy”) sets forth the personal information protection policy of Mirairo Inc. (hereinafter referred to as the “Company”) with respect to personal information handled by the Company in connection with the Mirairo ID Inbound Service for foreign visitors to Japan (hereinafter referred to as the “Service”).
The Service is intended for foreign visitors to Japan who hold a disability certificate (hereinafter referred to as “Users”) to use Mirairo ID as an identity verification tool in place of presenting a physical disability certificate within Japan. If a User is a minor or other person with limited legal capacity, their legal representative (hereinafter, the User and their legal representative are collectively referred to as “Users, etc.”) shall also be subject to this Policy. The Service is designed and provided on the assumption that it will be used within Japan, and use outside of Japan is not contemplated.
The Company shall manage personal information appropriately and endeavor to protect personal information in accordance with this Policy. Users, etc. may use the Service in accordance with the separately established Mirairo ID Terms of Use (hereinafter referred to as the “Terms of Use”) and this Policy.
Article 1. Scope of the Service and Governing Law
1. The Service is intended for foreign nationals visiting Japan and is premised on use within Japan. The Service is not offered to residents of any specific country or region, and it is not contemplated that nationals of such countries will use the Service while residing in their home country.
2. The handling of personal information under this Policy shall be governed by the Act on the Protection of Personal Information of Japan (hereinafter referred to as the “APPI”) and its related laws and regulations.
3. Access to the Service is limited to IP addresses within Japan, and Users may use the principal functions of the Service only when they are located within Japan.
4. Any and all disputes arising in connection with the Service shall be governed by the laws of Japan, and the Osaka District Court shall have exclusive jurisdiction as the court of first instance.
5. The handling of personal information under this Policy shall be governed by the APPI as set forth in the preceding paragraphs. The rights provided to Users by the Company under Article 13 and elsewhere in this Policy are provided voluntarily for the convenience of Users, regardless of whether such provision is required by law, and shall not constitute an acknowledgment by the Company that any personal information protection laws outside of Japan apply to the Service. Notwithstanding this paragraph, the rights afforded to Users under the laws of Japan shall be guaranteed in accordance with applicable laws and regulations.
Article 2. Definitions
1. Terms used in this Policy shall have the meanings defined in the APPI and its related laws and regulations.
2. In this Policy, “personal information” means information relating to a User that can identify the User by means of a name, email address, date of birth, nationality, or other description contained in such information (including information that, while not identifiable on its own, can be easily cross-referenced with other information to identify the individual User).
3. In this Policy, “special care-required personal information” means information concerning a User’s physical disability, intellectual disability, mental disability (including developmental disability), or other impairment of physical or mental function, and other special care-required personal information as defined in Article 2, Paragraph 3 of the APPI. Images of disability certificates constitute special care-required personal information.
4. In this Policy, “sensitive information” means personal information, including the special care-required personal information described in the preceding paragraph, the leakage or unauthorized use of which may infringe upon the personal dignity of a User or endanger the safety of their person or property. Images of disability certificates and information regarding the type and grade of disability contained therein, which are obtained in connection with the Service, constitute sensitive information.
Article 3. Basic Policy
1. Establishment of Rules for Handling Personal Information
The Company shall establish rules for the handling of personal information and appoint a person responsible for the management of personal information in order to ensure the appropriate management of personal information.
2. Appropriate Acquisition, Use, and Provision of Personal Information
The Company shall collect personal information by appropriate means and only to the extent necessary for its business operations. In addition, except as required by law, the Company shall not use personal information for purposes other than those communicated at the time of collection or provide personal information to third parties without consent, and shall take appropriate measures to prevent such occurrences.
3. Implementation of Security Measures
The Company shall take reasonable security measures, preventive measures, and corrective actions against risks such as unauthorized access to, loss, destruction, alteration, and leakage of personal information.
4. Response to Complaints and Inquiries Regarding the Handling of Personal Information
The Company shall appropriately respond to complaints and inquiries regarding the handling of personal information. In addition, when a request for disclosure, correction, deletion, or change in the scope of provision is made by the individual, the Company shall respond promptly and in good faith in accordance with applicable laws and regulations.
5. Compliance with Laws and Regulations
The Company shall comply with applicable laws and regulations, guidelines established by the government, other norms, and this Policy with respect to the acquisition, use, and other handling of personal information.
6. Continuous Improvement of Personal Information Protection Efforts
The Company shall continuously review and improve its personal information protection efforts to ensure that the rules for handling personal information are properly implemented.
The Company is certified as a “Privacy Mark” licensed operator.
Article 4. Personal Information Collected
1. The Company collects the following personal information in connection with the provision of the Service.
(1) Information collected at the time of account creation
i. Nationality (country information)
ii. Email address
iii. Password (stored in hashed form)
(2) Information collected at the time of disability certificate registration
i. Name
ii. Date of birth
iii. Image of disability certificate (constitutes special care-required personal information / sensitive information)
(3) Information automatically collected through use of the Service
i. IP address
ii. Device information (type of operating system, type of device, etc.)
iii. Coupon usage history
iv. Access logs
2. When collecting personal information from Users, the Company shall specify the purpose of use in advance and collect information by lawful and appropriate means.
Article 5. Purposes of Use of Personal Information
1. The Company shall use the personal information it collects for the following purposes.
(1) To provide and operate the Service
(2) To verify the identity of Users and the authenticity of disability certificates
(3) For AI-based review of disability certificates (including OCR (optical character recognition), detection of the presence of facial photographs, and automated determination regarding format and stated matters)
(4) To provide service features such as coupons
(5) To respond to inquiries from Users
(6) To improve the Service and to develop and analyze new services (provided that only information processed so as not to allow the identification of individuals shall be used for such development and analysis)
(7) To identify Users who violate the Terms of Use and restrict their use
(8) To provide important notices regarding maintenance, system failures, and other matters related to the Service
(9) To verify the authority and identity of a legal representative when a User is a minor, etc.
(10) To provide necessary notices and communications to legal representatives in connection with the provision and operation of the Service
(11) To confirm and respond to opinions and inquiries from Users’ legal representatives
(12) For purposes incidental to the above purposes of use
2. The purposes of use set forth in the preceding paragraph may be changed only to the extent reasonably deemed to be related to the purposes of use prior to the change. In such case, the Company shall notify Users of, or publicly announce, the changed purposes of use.
Article 6. Legal Basis for Processing Personal Information
1. The Company shall, as a general rule, collect and process personal information based on the consent of Users.
2. In addition to the preceding paragraph, the Company may process personal information in the following cases.
(1) When necessary for the performance of a contract with the User (including the Terms of Use)
(2) When necessary for the fulfillment of obligations under applicable laws and regulations
(3) When necessary to protect the life, body, or property of a User or a third party, and it is difficult to obtain the consent of the individual
(4) When particularly necessary for the improvement of public health or the sound development of children, and it is difficult to obtain the consent of the individual
(5) When it is necessary to cooperate with a national government organ, a local government, or a person entrusted by either of the foregoing in performing affairs prescribed by laws and regulations, and obtaining the consent of the individual is likely to impede the performance of such affairs
3. The handling of sensitive information (including special care-required personal information) shall be as set forth in Article 8.
Article 7. Use Beyond the Stated Purpose
The Company shall obtain the consent of the User when using personal information beyond the scope of the purposes of use set forth in Article 5; provided, however, that this shall not apply where any of the cases set forth in Article 6, Paragraph 2, Items (2) through (5) applies (i.e., where the APPI or other laws and regulations permit the handling of personal information beyond the scope necessary to achieve the purpose of use without obtaining the consent of the individual).
Article 8. Handling of Special Care-Required Personal Information (Sensitive Information)
1. The Company collects images of Users’ disability certificates (which constitute special care-required personal information / sensitive information) in connection with the Service. When collecting such information, the Company shall obtain the explicit consent of the User in advance. Such consent shall be obtained independently during the disability certificate registration process, with the details of the handling clearly specified, separate from the comprehensive consent to the Terms of Use. Where a User is a minor or other person with limited legal capacity, the Company shall, where necessary, obtain consent from the User's legal representative in addition to, or in place of, the User.
2. Images of disability certificates shall be used only for the following purposes.
(1) Verification of the authenticity of the User’s disability certificate (including AI-based review)
(2) Identity verification of the User
(3) Improvement of the accuracy of the Company’s AI-based determination (provided that such use shall be in a form that does not identify specific individuals; and as set forth in Article 9, Paragraph 2, User data shall not be used for training or fine-tuning Google’s AI/ML models)
3. The Company shall not provide images of disability certificates to third parties, except to the extent necessary for the AI-based review set forth in Article 9 and the outsourcing set forth in Article 10, Paragraph 4.
4. Users may withdraw their consent from the handling of sensitive information under this Article at any time. However, withdrawal of consent may result in the inability to use all or part of the Service. Withdrawal of consent shall not affect the lawfulness of processing performed prior to the withdrawal.
5. When a User requests the individual deletion of sensitive information, the Company shall delete such information within a reasonable period. Please contact the inquiry desk set forth in Article 19 for details on the deletion method.
6. In addition to the preceding paragraphs, the Company may collect special care-required personal information without the consent of the User in the following cases.
(1) When required by laws and regulations
(2) When necessary to protect the life, body, or property of a person, and it is difficult to obtain the consent of the individual
(3) When particularly necessary for the improvement of public health or the promotion of the sound development of children, and it is difficult to obtain the consent of the individual
(4) When it is necessary to cooperate with a national government organ, a local government, or a person entrusted by either of the foregoing in performing affairs prescribed by laws and regulations, and obtaining the consent of the individual is likely to impede the performance of such affairs
Article 9. AI-Based Review and Use of External Services
1. The Company performs automated determination using AI (artificial intelligence) on images of disability certificates uploaded by Users for the purpose of verifying the authenticity of disability certificates.
2. The AI-based review utilizes the Google Cloud Gemini Enterprise Agent Platform API (provided by Google LLC; hereinafter referred to as the “Agent API”).
Purpose: OCR (optical character recognition) of disability certificate images, detection of the presence of facial photographs (this does not involve facial recognition or facial matching that identifies a specific individual), and rule-based determination regarding format and stated matters by country
Data processing location: Google Cloud Tokyo Region (asia-northeast1)
The Company has entered into an appropriate data processing agreement (DPA) with Google Cloud, and pursuant to the contractual terms between the Company and Google Cloud, User data shall not be used for the training or fine-tuning of Google’s AI/ML models.
The Company treats the use of the Agent API as an outsourcing of the handling of personal data and shall exercise necessary and appropriate supervision over the handling of personal information by the outsourced party.
3. The results of the AI-based review shall be used as reference information for determining whether to approve the registration of a User’s disability certificate. If a User has any objection to the results of the AI-based review, please contact the inquiry desk set forth in Article 19. The Company shall take appropriate measures, including human review, in response to objections from Users.
4. The rights of Users regarding the AI-based review shall be as set forth in Article 13, Paragraph 2, Item (7).
Article 10. Provision of Personal Data to Third Parties
1. When providing personal data to a third party, the Company shall, as a general rule, obtain the consent of the User.
2. Notwithstanding the preceding paragraph, the Company may provide personal data to third parties without the consent of the User in the following cases.
(1) When required by laws and regulations
(2) When necessary to protect the life, body, or property of a person, and it is difficult to obtain the consent of the individual
(3) When particularly necessary for the improvement of public health or the promotion of the sound development of children, and it is difficult to obtain the consent of the individual
(4) When it is necessary to cooperate with a national government organ, a local government, or a person entrusted by either of the foregoing in performing affairs prescribed by laws and regulations, and obtaining the consent of the individual is likely to impede the performance of such affairs
3. The Company may provide information to participating businesses (such as coupon-issuing entities) in connection with the Service; however, the information provided shall consist solely of aggregated and statistical data and shall not include information that can identify individual Users.
4. The Company may outsource all or part of its personal information handling operations to external parties (including the use of external services for AI-based review as set forth in Article 9). In such case, the Company shall exercise appropriate supervision over the handling of personal information by the outsourced party and shall endeavor to protect Users’ personal information.
Article 11. Data Storage and Management
1. The Company stores and processes Users’ personal information on servers and databases located within Japan.
2. Users’ personal information shall not, as a general rule, be transferred outside of Japan. However, data may be transmitted to the Agent API (Tokyo Region (asia-northeast1)) to the extent necessary for the AI-based review set forth in Article 9, and such data processing shall be performed using the Google Cloud Tokyo Region endpoint.
3. The Company shall take the following security management measures to prevent unauthorized access to, leakage, loss, destruction, and alteration of personal information.
(1) Encryption of communications (HTTPS)
(2) Storage of passwords in hashed form
(3) Appropriate management of access privileges
(4) Provision of education and training on personal information protection to employees
(5) Development and implementation of emergency response plans for personal information security incidents
(6) Conduct of periodic audits regarding the handling of personal information
4. In the event that a security incident involving the leakage of personal information occurs or there is a risk thereof, the Company shall promptly take necessary measures and notify affected Users without delay.
Article 12. Data Retention Period and Deletion
1. The Company shall retain personal information necessary for the use of the Service until the User withdraws from the Service.
2. The Company may retain a User’s personal information for 7 days after the User’s withdrawal from the Service in preparation for erroneous processing or similar situations.
3. When a User withdraws from the Service, the Company shall delete all of the User’s personal information, including the following data, within 7 days after the withdrawal.
(1) Name
(2) Date of birth
(3) Email address
(4) Password (hashed)
(5) Nationality information
(6) Images of disability certificates (including approved ones)
(7) Coupon usage history
(8) Disability certificate images rejected by AI-based review
(9) Log data
4. Notwithstanding the preceding paragraph, where retention is required by laws and regulations, the necessary information shall be retained for the period prescribed by such laws and regulations.
Article 13. User Rights
1. The Company respects the rights of Users with respect to their personal information and shall respond in good faith to the exercise of User rights as set forth below.
2. Users may exercise the following rights against the Company.
(1) Right of Access (Right to Request Disclosure)
Users may request the Company to notify them of the purpose of using the User’s personal information held by the Company and to disclose such personal information.
(2) Right of Rectification
Users may request the Company to correct, add to, or supplement the User’s personal information held by the Company when such information is inaccurate or incomplete. Users may also view and correct their own information from the profile screen within the app.
(3) Right of Deletion
Users may request the Company to delete their personal information in the following cases.
i. When the purpose of use has been achieved, or the information is no longer necessary for achieving such purpose
ii. When the User has withdrawn their consent
iii. When the Company is handling personal information in violation of laws and regulations
Users may request the deletion of all personal information by withdrawing from the Service. In addition, sensitive information (such as images of disability certificates) may be individually requested for deletion without withdrawing from the Service.
(4) Right to Cease Use
Users may request the suspension of use or deletion of their personal information when the Company handles such information beyond the scope necessary for achieving the purpose of use or when it has been collected without the User’s consent.
(5) Right to Cease Third-Party Provision
Users may request the Company to cease the provision of personal data to third parties.
(6) Data Portability
Users may request the Company to receive the personal information they have provided to the Company in a structured, commonly used, and machine-readable format, and, where technically feasible, to transfer such personal information to another business operator designated by the User.
(7) Rights Relating to Automated Decision-Making
Users may request the Company to provide an explanation of the results of automated decision-making, such as AI-based review. In addition, if a User has any objection to the results of automated decision-making, the User may request a review involving human intervention.
(8) Withdrawal of Consent
Users may withdraw their consent to the handling of personal information at any time. Withdrawal of consent shall not affect the lawfulness of processing performed prior to the withdrawal. However, withdrawal of consent may result in the inability to use all or part of the Service.
3. Users who wish to exercise the rights set forth in the preceding paragraph should contact the inquiry desk set forth in Article 19. The Company shall respond within a reasonable period after verifying the User’s identity.
4. The Company may decline to comply with a request to exercise rights under the preceding paragraph in the following cases.
(1) When there is a risk of harming the life, body, property, or other rights or interests of the User or a third party
(2) When there is a risk of significantly impeding the proper implementation of the Service
(3) When compliance would result in a violation of other laws and regulations
(4) When the exercise of rights is restricted by applicable laws and regulations
5. When the Company declines to comply with a request to exercise rights pursuant to the preceding paragraph, the Company shall explain the reasons therefor.
Article 14. Cookies and Tracking Technologies
1. The Company may use cookies and similar tracking technologies in the Service for the following purposes.
(1) For User authentication and session management
(2) To improve the convenience of the Service
(3) For analysis of usage and improvement of the Service
(4) To ensure security and prevent unauthorized access
2. The types of cookies used by the Company are as follows.
(1) Essential Cookies: Cookies that are indispensable for the provision of the basic functions of the Service. Disabling these cookies may prevent the Service from functioning properly.
(2) Analytical Cookies: Cookies used to analyze usage of the Service and to assist in improving the Service.
3. Users may reject the acceptance of cookies or require confirmation each time through their device settings. However, rejecting cookies may result in the inability to use some functions of the Service.
4. The Company does not use cookies and tracking technologies for the purpose of identifying individual Users, or for the purpose of cross-site tracking or behavioral targeting advertising. However, if information obtained through cookies can identify an individual when combined with other personal information, such information shall be treated as personal information in accordance with this Policy.
Article 15. Use of Statistically Processed Data
The Company may create statistical data processed in a manner that does not allow the identification of individuals based on the personal information it has collected. The Company may use such non-identifiable statistical data without any restriction to the extent not prohibited by laws and regulations.
Article 16. Scope of Application
1. This Policy applies only to the Service.
2. The privacy policies of the respective link destinations or service providers shall apply to any services provided through URLs displayed within the app of the Service or through applications operated by third parties. The Company shall not be responsible for the handling of personal information outside of the Service.
Article 17. Disclaimer Regarding Acquisition of Personal Information by Third Parties
The Company shall not be liable for the acquisition of personal information by third parties in the following cases.
(1) When a User, etc. discloses personal information to a third party using the functions of the Service or other means (please contact the relevant third party directly regarding the handling of personal information by such third party)
(2) When an individual is unexpectedly identified based on information entered in the course of using the Service
(3) When personal information is provided by a User, etc. to, or used in connection with, services provided through applications operated by third parties accessed through links displayed within the app of the Service or after logging into the Service
(4) When a person other than the User, etc. obtains information that can identify the User, etc. (such as email address and password)
Article 18. Changes to This Policy
1. The Company may change this Policy at any time, except as otherwise required by laws and regulations.
2. In the event of a material change to this Policy, the Company shall notify Users of the details of the change or post it within the app or on the Company’s website before the change takes effect.
Article 19. Contact Information
For inquiries regarding this Policy, requests relating to the exercise of User rights, or other inquiries regarding the handling of personal information, please contact the following.
Mirairo Inc.
General Manager, Corporate Department
Contact: Contact Form
Date of Enactment and Enforcement: 2026/9/29
Mirairo Inc.
Representative Director: Toshiya Kakiuchi